Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate
Security NEXT has released its ranking of the ten most-read articles published on the site during the week of October 18–24, 2026. The list is dominated by vulnerability disclosures and security updates affecting widely deployed development and server software.
The top story reported a critical vulnerability in GitLab that received patches for both current and legacy branches. Second place went to multiple flaws in the nginx web server, three of which were rated critical. PHP appeared twice in the ranking with several serious vulnerabilities, including two remote-code-execution issues, prompting an update release and a U.S. government advisory recommending immediate remediation or offline operation if patching proved difficult.
Node.js issued a security update addressing ten vulnerabilities, one of which could allow remote code execution when processing Brotli-compressed data. U.S. authorities also issued alerts regarding active exploitation of vulnerabilities in Fortinet and BeyondTrust products. Google released Chrome 156, fixing 353 vulnerabilities including six rated critical.
The full top-ten list is as follows:
- 1. GitLab critical vulnerability – fixes also provided for older branches
- 2. Multiple vulnerabilities in nginx web server – three rated critical
- 3. Multiple serious vulnerabilities in PHP – fixed version scheduled for October 21
- 4. Node.js security update – release planned after October 21
- 5. Two serious RCE vulnerabilities in PHP – update released
- 6. U.S. authorities warn of exploitation of Fortinet and BeyondTrust vulnerabilities
- 7. Chrome 156 released, fixes 353 vulnerabilities including six critical
- 8. Ten vulnerabilities in Node.js – RCE risk via Brotli compression handling
- 9. U.S. authorities urge immediate patching of PHP vulnerabilities – take systems offline if necessary
- 10. PHP vulnerability showed signs in 2024 but remediation proved difficult – confusion before disclosure
All articles appeared on Security NEXT and were dated October 26, 2026.
Related articles
Critical SQL Injection Flaw in Arista VCO Already Exploited in Attacks
Arista Networks disclosed a critical SQL injection vulnerability in its VeloCloud Orchestrator product used for SD-WAN network management. The flaw, tracked as CVE-2026-114625, carries a CVSS v4.0 base score of 9.4 and a CVSS v3.1 score of 9.9, placing it in the highest severity category. Exploitation requires network access to the management interface and an authenticated session with Enterprise Read Only privileges or higher, after which attackers can escalate rights to reach internal management functions and compromise managed systems and data. The vendor has already observed active exploitation of the issue in the wild. Patches are available in versions 6.4.2.12, 6.1.3.10, and 5.2.3.18, and customers are urged to apply the updates immediately.
Researcher Develops Kernel Exploit for TP-Link EAP770 to Disable Faulty Qualcomm SFE Offload
A user who purchased the TP-Link EAP770 v1 Wi-Fi 7 access point in 2023 discovered persistent data corruption during large file transfers over Wi-Fi. The root cause was a DMA cache coherency bug in the Qualcomm qca-nss-dp driver combined with SFE/PPE hardware offload that recalculated TCP checksums on corrupted packets. TP-Link ended support for the v1 model before release and provided no firmware updates, while the device's restricted shell prevented the required sysfs writes. The researcher chained CVE-2022-0185 with pipe buffer manipulation to achieve root access, disable the offload features, and stop the corruption without bricking the device. The exploit was developed and tested first in QEMU using the closest available GPL kernel sources from the EAP783 model before being adapted to the live hardware. A separate unrelated bug was also found in the client Wi-Fi card firmware causing connection drops.
Apple iOS Security Architecture: From Power Button to App Launch in Modern Devices
The article examines the complete boot and trust chain in modern iPhones, starting from the immutable BootROM and progressing through iBoot, the XNU kernel, and the Secure Enclave. It explains how Secure Boot verifies signatures but does not guarantee absence of vulnerabilities, allowing exploits like checkm8 to persist across devices. The piece details data protection classes, BFU versus AFU states, and how passcodes interact with hardware-bound keys to limit brute-force attempts. It further describes application sandboxing, entitlements, code signing, and Pointer Authentication (PAC) as layered defenses that raise the cost of exploitation. The analysis shows why modern jailbreaks require multi-stage chains involving kernel read/write, sandbox escapes, and PAC bypasses rather than single vulnerabilities. Overall, the architecture transforms privilege from a simple scalar into a graph of capabilities across isolated components.
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both scoring CVSS 9.2, were disclosed on October 21. The flaws allow attackers to execute arbitrary code without authentication by triggering out-of-memory conditions that lead to use-after-free memory corruption. Exploitation involves specially crafted requests that manipulate uninitialized arrays and function pointers, with full chains demonstrated via PHP_SESSION_UPLOAD_PROGRESS and fatal error backtraces. The issues affect PHP versions starting from 5.4 and were discovered using AI tools Gemini 4 Argon and GPT-5.6 Sol, resulting in a patch exceeding 10,000 lines of code. Amazon detected attacks as early as October 17, with Cloudflare later reporting millions of exploitation attempts. Mitigation requires updating to patched versions such as PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, while temporary workarounds include disabling session upload progress and fatal error backtraces.